Authentication
How Graphon authenticates requests, how to send your API key, the key format, and the authentication errors.
API keys
Every machine request needs an API key. A key belongs to one workspace. Its role is viewer, editor, or admin. It covers every bucket in the workspace. Graphon shows the key once, when you create it. The Authentication guide explains personal and workspace keys, S3 credentials, presigned URLs, and when a revoke takes effect.
Send the key
Send the whole key in the authorization header.
Header
Authorization: Bearer <GRAPHON_API_KEY>| Surface | Host | How the key is sent |
|---|---|---|
| Graphon API | https://api.beta.graphon.ai | Bearer token |
| Storage API | https://storage.beta.graphon.sh | Bearer token |
| S3 API | https://wspq7ws2np5l8z4.storage.beta.graphon.sh | SigV4: the access key ID and the whole key as the secret |
cURL
curl \
--url "https://api.beta.graphon.ai/v1/workspaces/$GRAPHON_WORKSPACE_ID/members" \
--header "Authorization: Bearer $GRAPHON_API_KEY"
curl \
--url "https://storage.beta.graphon.sh/v1/workspaces/$GRAPHON_WORKSPACE_ID/buckets" \
--header "Authorization: Bearer $GRAPHON_API_KEY"Workspace scope
/v1/workspaces/{workspaceId}. S3 uses that workspace ID in the hostname. Replace wspq7ws2np5l8z4 with your own ID.Key format
An API key starts with gak_. The access key ID is the part between the _ and the .. It is not secret. Key lists show a masked key, such as gak_GAK1a8Xk2mQ9pL0vT4cZ.••••, so the rest of the key stays hidden.
Format
gak_<access key ID>.<signature>
gak_GAK1a8Xk2mQ9pL0vT4cZ.Qm9…A key that starts with gtk_ is a temporary key. The app and the CLI make temporary keys for you. They work only on the Storage API and the S3 API.
Authentication errors
The Graphon API returns 401 unauthenticated for a missing, unknown, revoked, or expired key. It returns 403 forbidden when the key's role is too low. The Storage API and the S3 API return these errors:
| Problem | Storage API | S3 API |
|---|---|---|
| No key | 401 unauthenticated | 403 AccessDenied |
| Unknown, revoked, or suspended key | 401 unauthenticated | 403 InvalidAccessKeyId |
| Expired key | 401 unauthenticated | 403 ExpiredToken |
| Wrong key or signature | 401 unauthenticated | 403 SignatureDoesNotMatch |
| A bucket in another workspace | 403 forbidden | 403 AccessDenied |
| Role too low | 403 forbidden | 403 AccessDenied |
Object keys
incidents/checkout-timeout.json becomes a keyToken in the object path.